{"id":39716,"date":"2020-08-10T20:35:00","date_gmt":"2020-08-10T12:35:00","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=39716"},"modified":"2020-08-10T20:52:24","modified_gmt":"2020-08-10T12:52:24","slug":"sophos-reports-on-realities-of-ransomware","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2020\/08\/10\/sophos-reports-on-realities-of-ransomware\/","title":{"rendered":"Sophos reports on realities of ransomware"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Sophos, a global player in next-generation cybersecurity, published a multi-part research series on the realities of ransomware, including an industry-first detailed look at new detection evasion techniques in WastedLocker ransomware attacks that leverage the Windows Cache Manager and memory-mapped I\/O to encrypt files. <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A complementary article examines the evasion-centric arms race of ransomware, providing a months-long review of how cybercriminals have been escalating and markedly changing evasion techniques, tactics and procedures (TTPs) since <a href=\"https:\/\/news.sophos.com\/en-us\/2019\/12\/09\/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection\/\">Snatch ransomware<\/a> in December 2019.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cThe reality is, ransomware is not going away. At Sophos, we\u2019ve seen gangs like WastedLocker taking evasive tactics to a new level and now even finding ways to bypass behavioral anti-ransomware tools. This is the latest example of attackers getting their hands dirty, using new maneuvers to manually disable software as a precursor to a full blown ransomware attack. Other stealthy activities like exfiltrating data and disabling backups are also precursors. The longer attackers are in the network, the more damage they can inflict,\u201d said Chester Wisniewski, principal research scientist, Sophos. \u201cThis is why human intelligence and response are critical security components to detect and neutralize early indicators that an attack is underway. Organizations need to know about escalating trends and harden their perimeter by disabling remote access tools like RDP whenever possible to prevent crooks from gaining access to the network, a common denominator in many ransomware attacks that Sophos analyses.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The combination of these changing attacker behaviors and remote and\/or hybrid working environments due to the global COVID-19 pandemic is signaling an urgent need for organizations to prioritize IT security. Businesses also need to future-proof security implementations in anticipation of always-adapting adversaries, disintegrating boundaries, and the expanded attack surface caused by COVID-19.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The lineup of Sophos research includes<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/news.sophos.com\/en-us\/2020\/08\/04\/wastedlocker-techniques-point-to-a-familiar-heritage\">WastedLocker\u2019s techniques point to a familiar heritage<\/a><\/li><li><a href=\"https:\/\/news.sophos.com\/en-us\/2020\/08\/04\/the-realities-of-ransomware-the-evasion-arms-race\">Ransomware\u2019s evasion-centric arms race<\/a><\/li><li><a href=\"https:\/\/news.sophos.com\/en-us\/2020\/08\/04\/the-realities-of-ransomware-five-signs-youre-about-to-be-attacked\">5 signs you\u2019re about to be hit by ransomware<\/a><\/li><li><a href=\"https:\/\/news.sophos.com\/en-us\/2020\/08\/04\/the-realities-of-ransomware-extortion-goes-social-in-2020\">The realities of ransomware: extortion goes social<\/a><\/li><li><a href=\"https:\/\/news.sophos.com\/en-us\/2020\/08\/04\/the-realities-of-ransomware-why-its-not-just-a-passing-fad\">Ransomware: why it\u2019s not just a passing fad<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Immediate advice for defenders<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Shut down internet-facing remote desktop protocol (RDP) to deny cybercriminals access to networks<\/li><li>If you need access to RDP, put it behind a VPN connection<\/li><li>Use layered security to prevent, protect and detect cyberattacks, including endpoint detection and response (EDR) capabilities and managed response teams who watch networks 24\/7<\/li><li>Be aware of the <a href=\"https:\/\/news.sophos.com\/en-us\/2020\/08\/04\/the-realities-of-ransomware-five-signs-youre-about-to-be-attacked\">five early indicators an attacker is present<\/a> to stop ransomware attacks<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Sophos, a global player in next-generation cybersecurity, published a multi-part research series on the realities of ransomware, including an industry-first detailed look at new detection evasion techniques in WastedLocker ransomware attacks that leverage the Windows Cache Manager and memory-mapped I\/O to encrypt files. <\/p>\n","protected":false},"author":6,"featured_media":38246,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[54,2103,3914,53,4100,4234,206],"class_list":["post-39716","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-security","tag-security-breach","tag-security-platform","tag-security-risk-management","tag-security-solutions","tag-security-as-a-service","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/39716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=39716"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/39716\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/38246"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=39716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=39716"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=39716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}